CVE-2026-111993: Cleartext Storage of Sensitive Information in Soarkey StudentManagement

This vulnerability exists in Soarkey StudentManagement up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e, specifically in the UserDao.login function within code/src/service/AdminDao.java. The issue arises from manipulation of the Password argument that leads to cleartext storage of sensitive information. The attack vector is local access with low complexity and no privileges required beyond local execution. Exploit code has been published. The project was informed early but has not issued a fix or response.

Sensitive information, such as passwords, is stored in cleartext, increasing the risk of credential compromise if an attacker gains local access. This could lead to unauthorized access or further attacks if credentials are reused. However, exploitation requires local access, limiting the attack surface. There is no indication of remote exploitation or privilege escalation.

No official fix or patch is currently available as the vendor has not responded. Users should restrict local access to trusted personnel only and monitor for suspicious activity. Since the vulnerability requires local execution, limiting physical or local system access reduces risk. Check the vendor advisory regularly for updates or patches.